Loki detected_fields query limits results in unbounded memory allocation
Medium
- Advisory ID:
- CVE-2026-21729
- Published:
- 2026-07-15
- Product:
- Loki
- CVSS Score:
- 7.5
- CVSS Vector:
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Fixed Versions:
- >=3.7.0
Summary
The Loki detected_fields endpoint allocates 2*limit elements in slices and maps based on the user-supplied limit query parameter, regardless of actual result count. A massive limit value (e.g. 600000000) allocates 20-30 GiB even with zero matching results, causing OOM, resulting in denial of service.